Privacy Policy

Who we are and how to contact us

The data controller responsible for your personal data is:

Operator

Inam Ul Haq

Postal address

Raiffeisenstraße 23, 56072 Koblenz, Germany

Email

inam101001@gmail.com

For any privacy question or to exercise your rights, contact us at inam101001@gmail.com. We aim to respond within 30 days.

Data we collect

We collect only the data needed to run your job-search workspace and the features you choose to use:

Account information

Your name, email address, and a securely hashed password. If you sign in with Google, we receive your Google account's email address and basic profile (name and profile picture) instead of a password.

Job-search content

The applications you track, their statuses and notes, interview dates, uploaded CVs and resumes, generated cover letters, ATS feedback, and company or role information you add.

Google Calendar data (only if you connect it)

With your explicit consent, an encrypted OAuth access/refresh token, the interview events Applyst creates on the calendar you choose, and read access to your free/busy availability while scheduling. Applyst does not access Gmail or any other Google service.

AI feature inputs

When you use an AI tool (CV tailoring, cover letters, ATS scoring, and similar), the relevant text — such as your CV and the job description — is sent to a third-party AI model provider to generate the result.

Billing information

If you subscribe to a paid plan, payments are processed by Stripe. We store your subscription status and a Stripe customer identifier; we never receive or store your full card details.

Usage and technical data

Basic usage metrics, feature counts for quota enforcement, rate-limiting signals, and standard server logs (such as IP address and timestamps) used for security and to operate the service.

How we use your data

• To provide the core service: tracking applications, storing your documents, and running the features you request.
• To generate AI-assisted materials when you explicitly trigger an AI tool.
• To create and manage interview events on your Google Calendar when you connect it.
• To process subscriptions, enforce plan limits, and prevent abuse.
• To secure the service, debug problems, and comply with legal obligations.

We do not sell your personal data, and we do not use it for advertising.

Google user data and Limited Use

Applyst's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, the Google Calendar data Applyst accesses is used only to provide and improve the user-facing calendar features you request — creating and updating interview events and reading your free/busy availability. This data is not used for advertising, is not sold, and is not used to train generalized or non-personalized artificial intelligence or machine-learning models. We do not transfer this data to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition, and always subject to your consent where required.

You can disconnect Google Calendar at any time from Settings → Integrations, which revokes Applyst's access token. You can also review and revoke access at myaccount.google.com/permissions.

AI processing and third-party model providers

AI features send the text you submit to a third-party AI model provider to generate a response. Depending on the configured provider, this may include OpenAI, Anthropic, Google, or OpenRouter. These providers process the content solely to return the requested result and, under their API terms, do not use API-submitted content to train their models.

Do not include information you are not comfortable sharing with a third-party AI provider in fields that feed AI tools.

Service providers we share data with

We rely on a small set of processors to run Applyst. Each only receives the data needed for its function:

MongoDB Atlas

Stores your account and job-search data (database hosting).

Vercel

Hosts and serves the application.

Stripe

Processes subscription payments.

AI model providers

Process AI feature inputs, as described above.

Google

Provides Calendar and sign-in, only if you connect them.

Legal bases for processing (GDPR)

• Performance of a contract (Art. 6(1)(b)): providing the account, tracking, and features you sign up for.
• Consent (Art. 6(1)(a)): connecting Google Calendar and other optional integrations. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, and improving reliability.
• Legal obligation (Art. 6(1)(c)): retaining records where required by law.

International data transfers

Some of our providers (for example, certain AI providers and Stripe) are located outside the European Economic Area, including the United States. Where data is transferred outside the EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

Data retention

We keep your personal data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records to comply with legal obligations (for example, billing records). Google Calendar tokens are deleted when you disconnect the integration.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, email inam101001@gmail.com. You also have the right to complain to your local German data protection authority if you believe your data has been mishandled.

Data security

We use industry-standard measures to protect your data, including encryption in transit, hashing of passwords, and encryption of stored Google OAuth tokens. No system is perfectly secure, but we work to protect your information and to limit access to it.

Children

Applyst is not directed to children. You must be at least 16 years old to use the service, consistent with the minimum age for valid consent in Germany.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you within the app.